A company uses AWS Organizations to manage multiple AWS accounts. The security team needs to ensure that Amazon CloudTrail is enabled in all AWS Regions for every member account, and that no user (including account administrators) can disable it. The policy must apply automatically to any new accounts that are added to the organization. Which AWS feature should the security team use to enforce this requirement?

IAM policies with a Deny effect for CloudTrail actions

IAM policies can restrict permissions, but they are scoped to a specific IAM user, group, or role. Account administrators can modify or create new IAM policies to bypass these restrictions, so they do not provide a centrally enforceable guardrail across all accounts.

AWS Config rules with an auto-remediation action

AWS Config rules can evaluate whether CloudTrail is enabled and can trigger a remediation action (e.g., re-enabling CloudTrail) if a violation is detected. However, they cannot prevent the action from occurring in the first place; they only react after the fact. Also, Config rules are scoped per account, not centrally enforced across the organization.

AWS CloudTrail trails with multi-region and organization trail enabled

An organization trail can log events from all accounts to a single bucket, but it does not prevent users from disabling or deleting the trail. It is a logging mechanism, not an enforcement mechanism. SCPs are required to enforce the desired restriction.

What does this CLF-C02 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Service Control Policies (SCPs) — Service Control Policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts in your organization. SCPs can restrict which AWS services, actions, and resources can be used, and they apply to all IAM users, roles, and root users in the account. By creating an SCP that denies the `cloudtrail:StopLogging` and `cloudtrail:DeleteTrail` actions, the security team can prevent anyone from disabling CloudTrail, even account administrators. SCPs are inherited by all existing and new accounts in the organization, making them ideal for enforcing baseline security controls. IAM policies alone are insufficient because account administrators can modify or remove them. AWS Config rules can detect noncompliance but cannot prevent actions. AWS CloudTrail trails themselves cannot enforce policies on other accounts.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.